How big of a problem are enabled resource accounts?

Long-time lurker here. I really appreciate how much knowledge is shared in this community.

Something I keep noticing in Entra ID environments is resource accounts like shared mailboxes, rooms, and equipment mailboxes that still have sign-in enabled.

I’m curious how others see this.
How big of a security risk do you think it actually is in practice?
And why do we think it’s so common?

It’s one of those things that is incredibly simple to fix, but seems to slip through almost everywhere. Is it lack of ownership, habit, or just something people don’t think about because it doesn’t break anything?

For context, I work with identity visibility and automation at a small startup called Bsure.
I recently wrote a short article on this topic, not to promote anything, but because I wanted to understand why it keeps happening: https://www.bsure.io/insights/low-hanging-fruit-entra-id-security

Would really like to hear how others think about this.